What do I do when Windows XP ends?
 

I have browsed few sites but come
up with conflicting stuff

I thought the forum would have a consensus of what is the
best thing to do when Windows XP ceases being supported

What do I do - preferably without shelling out extra money?

Re: What do I do when Windows XP ends?
 

Either keep using it and accept that your PC will be more and more vulnerable as time passes or move to a Linux Distribution.

Re: What do I do when Windows XP ends?
 

ok

Re: What do I do when Windows XP ends?
 

Not unduly worry about it until your PC itself dies or is no longer powerful enough for what you need. There will be hundreds of thousands of people out there still running XP. Meanwhile ensure you do have a current antivirus, and don't worry about lining Bill Gates' pension fund.

Re: What do I do when Windows XP ends?
 

You should be ok as long as you have a good antivirus and firewall (I use both a software firewall and the one built into the superhub2). I've had about 5 viruses since getting my first pc back in the late 90's and non of them were system killers. the two worst ones were one that renamed all my mp3 files into dos filename format a very long time ago and the other was one that installed a batch file that caused the pc to shut down as soon as it was started up. The latter was really easy to remove once I figured out what it was.

Re: What do I do when Windows XP ends?
 

They actually rolled out an IE security update last week, after the end of the support.
They said it made sense to make sure everyone was safe.
I suspect they will do so again if a really bad problem emerges.

Re: What do I do when Windows XP ends?
 

End of support doesn't mean end of support if Microsoft release an update after the deadline.

The IE security patch for XP is good because it keeps those still using the OS safer. However, I think the release means people won't be so inclined to say goodbye to XP. Having received one patch, it will always be hoped further ones will be released if a vulnerability is serious enough. Again, this could be good but I can't help thinking that it is time to leave XP behind. It's been supported for 12½ years. A long time for any OS. I can't think of any other platform where an OS has been supported for that length of time.

Re: What do I do when Windows XP ends?
 

My trusty Samsung NC-10 uses XP, but will not work with Win 8, despite the fact I have 2GB of RAM.

I did look at upgrading to Win 7, but think why bother I'm careful what I access on it.

Re: What do I do when Windows XP ends?
 

I don't see what the deal is with obsessively hanging on to out of date software. If you use up-to-date hardware like me then most of the time it won't work properly with older OS' anyway and you lose half the benefits of having it.

Then again most of the time I get Microsoft products free of charge, and even if I didn't, I couldn't care less about "lining bill gate's pocket". He lines my pockets most of the time anyway. If Windows didn't break so often I wouldn't be getting paid so much to fix it.

Re: What do I do when Windows XP ends?
 

I can see your point when everything works OK but just an opinion about Microsoft's pockets. I've been using/buying Microsoft operating systems since 1995. The cost for them over that time is, more or less:

Windows 95 to 98SE - About £80 I think ..but can't be certain.
XP Pro disk - £100 (retail).
Windows 7 - £45 (bought retail on the pre-release price offer).
Windows 8 Pro - £25 (price from Microsoft as an early purchaser).

£250 since 1995 works out at about £13 a year. Maybe that's a bit more than some pay because the operating system very often comes pre-installed on new computers. I don't know how much of the cost of a new computer is the operating system. £13 a year doesn't seem excessive for all of the hours of usefulness and interest the operating systems have given. Not much else these days gives that sort of value.

The reason Microsoft is so successful is because they have sold operating systems and other products in the millions. Not (I feel) because they have been charging us too much as individuals.

Re: What do I do when Windows XP ends?
 

It's trivial to bypass most AV's using standard settings and many software firewalls if you are able to exploit a vulnerability through a browser and drive-by download, so don't feel they protect you 100%. There is always a time frame before signatures appear for newly found stuff. For something that isn't spread wide then there may not be a signature for it at all. Then there are various custom cryptors and things like powershell payloads which nearly all the AV's don't stop.

Turning heuristics on in the AV will help a lot although may also give you more false alarms.

Re: What do I do when Windows XP ends?
 

I only moved up when I got a new PC(built by my son). Only had to replace the scanner..and I'd only just replaced the printer..so I had no other issues.
I'll wait to upgrade to another OS until I need to upgrade this PC.

Re: What do I do when Windows XP ends?
 

New incarnations of Windows invariably require more power and more space, so I only upgrade when buying a new PC, and usually I get the OS for "free" i.e. bundled.

Incidentally, I am still using the FIRST versions of MsMoney and MsWorks... they do the job perfectly.

Re: What do I do when Windows XP ends?
 

Good luck finding a rootkit in running tasks.

I'm still impressed how easy it is to fumble some people by just renaming your trojan "iexplore.exe"

Re: What do I do when Windows XP ends?
 

AVG (and all other online AV packages) frequently fail to detect rootkits as well.

Though I agree on the vulnerability issue. It's no different to if you forgot to run Windows Update for a few months (or years). Or had it turned off, deliberately or otherwise.

Especially if the machine has external network access control enforced properly, there's no real risk. Plenty of banks and retailers still have terminals (e.g. ATMs and POS terminals) still running XP, 2000, or even NT4. Saw a Windows 98 bluescreen on a bus display not too long ago.

If it has no network access and you don't shove dubious removeable media in it all the time, there's no real risk.

If it has network access then a proper firewall along with keeping whatever server software it is you're running up to date is enough.

Re: What do I do when Windows XP ends?
 

What exactly do you use to show you what is playing with APIs?

It sounds impressive but I'm not entirely sure how software running in ring 3 would be able to monitor the actions of software running in ring 0, or what process monitor is going to tell you beyond that a system call was made, it will report back what the rootkit is providing.

AVG and other things use the same system calls the rootkit has hooked and will have the exact same issues.

I'm actually asking the question as I genuinely have no idea how you would be able to detect rerouted system calls from user space, or what use looking at running tasks would be.

Re: What do I do when Windows XP ends?
 

Okay. When I have some time I'll rootkit a VM and see what that program spots then probably start another thread in the security section.

It would be good to see what it actually does. If it's just monitoring IATs of processes and their calls to windows APIs through their IAT it'll be nonethewiser from a decent rootkit, the rootkit will rewrite the destination of the call in RAM and then redirect to the original API.

If the rootkit is playing games in ring 0 with the IDT, SSDT and copying its own handlers to dlls you're probably hosed whichever way.

EDIT: Just to be clear I don't recommend anyone do what I''m going to on a real machine. Dynamic analysis of nasty files does involve running them which means all your bases will belong to the nastiness maker :)

These programs are useful to watch things that aren't trying hard to hide themselves, you can get a good idea of their behaviour for sure. I use Process Monitor quite a bit when reverse engineering Windows binaries to get a high level view of what a program is doing.

Probably a bit late but you may have found https://www.coursera.org/course/malsoftware interesting.

Re: What do I do when Windows XP ends?
 

Hah don't bow to my knowledge on this stuff, I'm just an enthusiastic amateur.

Re: What do I do when Windows XP ends?
 

API monitor and Process Explorer (good old sysinternals, now MS) may allow you to spot some of the simple viri but usually rootkits send back false information to the API calls they use. Detecting a proper rootkit through looking at processes and memory is nigh on impossible, you have to rely on what is written to disk.

Programs that try to detect if you have a rootkit installed usually do things like use the windows API functions to get directory listings or on all folders (which often rootkits intercept and return a listing minus it's own files) or registry entries and then use raw disk reads to see if the results are the same. Many rootkits like TDSS look out for certain programs being run and will intercept many rootkit killer type programs but changing the executable name is enough to bypass that.

Obviously the best way to detect a rootkit is to boot from a cd, stopping the rootkit loading up and hiding itself which is what would happen with a normal boot. If you can't do this, I suggest using something like Combofix from the bleeping computer website which works very well.

Persistent BIOS rootkits have had a few proof of concepts and they are the ultimate really as there is no way to find those. At present there is no way to install these except by tricking a user in to doing it themselves, although I wouldn't put it past the three and four letter agencies to be able to it without user interaction.

As large corporations will continue to get XP support for some time, I expect someone will start releasing the patches they get to the general public.

---------- Post added at 13:37 ---------- Previous post was at 13:13 ----------

Keep in mind some rootkits are virtual machine aware and can break out to the main machine using vulnerabilities in the software. Most of the issues are patched in later versions but there is always the possibility of there being a new unknown vector for them to take advantage of.

Re: What do I do when Windows XP ends?
 

Just use some super obscure VM that is not binary compatible with the host like Oracle VM (and I mean Oracle VM on Solaris, not Virtualbox). :P

Re: What do I do when Windows XP ends?
 

Something that seems to be getting overlooked in the forgetting "to run Windows Update for a few months (or years)" comparisons is that when software stops being supported efforts to compromise it ramp up rather significantly.

Re: What do I do when Windows XP ends?
 

17% of home users computers are still using XP according to a report I saw today. One is six is not a good amount. Add on top what anti-virus vendors are saying in another thread I started and you can see this will get messy.

Re: What do I do when Windows XP ends?
 

Wont be of any use to the rootkit if it does. It's not going to be in a Windows hypervisor.

Re: What do I do when Windows XP ends?
 

Windows hypervisor has been broken by exploits on numerous occasions. There was this one a few months back but that was the host access the guest. Although the idea behind hypervisors is great for protection, they can have their own problems too.

From 2012

Re: What do I do when Windows XP ends?
 

http://www.malwarebytes.org/antirootkit/ FREE

Re: What do I do when Windows XP ends?
 

Unsure if you read but I said that it won't be running inside a Windows hypervisor. I'm not using a hypervisor for security but because you need a hypervisor to run VMs on.

It'll actually be running on a dedicated ESXi host, whose other guest OS are a couple of proprietary Linux-based VMs along with a very cut down proprietary Linux OS and a ridiculously basic Linux OS that does nothing but emulate a WAN.

Even if a nasty is able to log into one of the *nix VMs as root it just gets that one machine. That host has access neither to the Internet or to the rest of my LAN as it sits in an isolated 'DMZ' VLAN which has no routing outside of the VLAN and no access to its first hop router besides DHCP and DNS.

Better not to mix the home network and the lab network.

Re: What do I do when Windows XP ends?
 

Doesn't ESXi (or was it ESX) run on top of a modified RHEL core?

Re: What do I do when Windows XP ends?
 

ESXi uses its own kernel. It has a ton of similarities to RHEL, etc, but uses its own kernel and has a very small selection of libraries available. Any exploit would need to be compiled specifically for ESXi.

To actually do anything would require a rootkit that runs on Windows, uses a red pill to detect the Hypervisor, then breaks out of its VM by exploiting ESXi which would require various statically linked libraries and/or payloads which it can't download as it doesn't have Internet access, and manages to take control of ESXi.

Something that does all that would be absolutely state of the art and likely way beyond my capability to analyse anyway. I'm not going to be downloading mysterious malware to test but recognised Windows PE only samples :)

Re: What do I do when Windows XP ends?
 

Yeah, I was just giving that as an interesting example. ESX/ESXi has had it's fair share of exploits too but i'm not aware of any infections that make use of them. If it was connected to the net (I saw your box wasn't) then it could still be possible for an outside attacker to elevate themselves to full control of the box rather than the one virtual machine, if you run the old versions or a new exploit is found. All manual work though.

Was just making the point that hypervisors were not 100% foolproof like they are supposed to be.

Was thinking of getting a microserver to run ESXi on and just have lots of servers on it as vm's running all at the same time.

Re: What do I do when Windows XP ends?
 

Fortunately none of those are for ESXi 5.5 so I'm probably all good for now.

Hypervisors are like everything else, if there's a vector there're probably bugs.

---------- Post added at 22:13 ---------- Previous post was at 22:09 ----------

Sadly due to memory requirements I use a full server for ESXi. My microserver is actually on my home network and does more mundane duties.

Re: What do I do when Windows XP ends?
 

Ah, it was ESX (no i) that used the RHEL userspace and Linux 2.4 kernel.

Not something I'd expect to see outside of an academic proof of concept tbh, way too niche a target.


... Actually now that I think about it, maybe not. VMWare has a sizeable share in the enterprise virtualization market and compromising host machines could present a particularly juicy target.

Re: What do I do when Windows XP ends?
 

I would move to Windows 7.

I stuck with XP for a long while whilst the messed up Vista OS was out. Never wanted Vista on my machine.
Then Microsoft finally created a decent OS and Windows 7 is not as memory hungry and runs well. I now use Windows7 as my stable OS to install.

You may find also that manufacturers of hardware will have developped updated drivers for some of your hardware that now needs a better OS to run on.

Re: What do I do when Windows XP ends?
 

Windows 7 is really just as memory hungry as Vista. You just don't notice because hardware got faster and memory got cheaper in the meantime.

Win 7 is equally horrific to try and run on 1GB of RAM as Vista was, both require 2GB as a minimum and ideally 4GB or more.

That said business versions of W7 include XP Mode which gives you an option to run a lot of older and incompatible software, but I expect that'd also be going out of support now that XP itself is.

Re: What do I do when Windows XP ends?
 

Vista didn't really run well even if you did have good hardware, I've upgraded a lot of people from Vista to 7/8 and the difference is very noticeable!

Re: What do I do when Windows XP ends?
 

I disagree. Vista ran perfectly fine on my machines and the various technological advancements it incorporated meant a number of tasks were an order of magnitude faster than XP. When Windows 7 came along it improved reliability and useability, but there certainly was nowhere near the speedup I experienced going from XP to Vista. Not to mention Vista improved my laptop battery life by about 40%, while 7 made no difference (since everything there was to improve was already incorporated in Vista)

Re: What do I do when Windows XP ends?
 

Windows Embedded POSReady is a windows xp version for point-of-sale machines which will get microsoft support and updates until 2019. So with a registry hack in your normal windows XP you can make Microsoft think you have the Embedded POSReady version and continue to get security updates.

Create the following registry entry and data:

The easiest way to do this is to copy and paste the above in to a notepad file and save it as "something.reg", then double click on the newly created file and agree to let it enter the change in to the registry. After that Windows Action Centre/Windows update should show patches for the next 5 years. I doubt it will 100% keep XP secure but it's the best option for those not upgrading their XP copy.

Re: What do I do when Windows XP ends?
 

Good post :tu:

Re: What do I do when Windows XP ends?
 

Come in to 2014 and get Windows 7...

http://www.amazon.co.uk/Microsoft-Wi...ords=windows+7

or you can get it cheaper still second hand on eBay (about £30 usually incl shipping).

Re: What do I do when Windows XP ends?
 

Try running Windows 98, that last saw an update in 1998.

As there is no CD for some software that is on it, and the guy who owned it died 2 years ago.